ICT Security-Sécurité PC et Internet

CES 2020 : Le secteur automobile préoccupé par la cybersécurité
Sécurité : Les voitures connectées ne sont pas infaillibles face aux risques de piratage. Une société israélienne de cybersécurité en fait la démonstration au CES de Las Vegas.

En matière de cybersécurité automobile, le risque zéro n'existe pas. La société israélienne de cybersécurité GuardKnox a simulé lors du CES la prise de contrôle à distance du poste de conduite d'une Formule 1, selon des informations rapportées par l'AFP.

"Prenons l’exemple d’un gros camion qui transporte du carburant. Imaginez un criminel qui parvient à en prendre le contrôle. Il peut l’envoyer dans le fossé ou dans un bâtiment. C’est le 11 septembre sur roues", a déclaré son directeur, Moshe Shlisel, sur le salon.

Les voitures comportent des dizaines de processeurs et de plus en plus d'applications sur l'ordinateur de bord. Autant de passerelles dont des hackers peuvent se servir.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Cars

A bug that allowed two researchers to gain access to the backend systems of a popular internet-connected vehicle management system could have given a malicious hacker everything they needed to track the vehicle's location, steal user information, and even cut out the engine.

In a disclosure this week, the researchers Vangelis Stykas and George Lavdanis detailed a bug in a misconfigured server run by Calamp, a telematics company that provides vehicle security and tracking, which gave them "direct access to most of its production databases."

Car hacking has become a major focus in the security community in recent years, as more vehicles are hooked up to the cellular internet. But while convenient to control your car from your phone, it's also opened up new points for attack -- which could have real-world consequences.

You might not even realize you're a Calamp user. Many apps, including the vehicle tracking app Viper SmartStart, which lets users locate, start, and control their car from their phone, connects to the outside world using a Calamp modem to its cloud-based servers.

The researchers found that the Viper mobile app, while secure, was connecting to two different servers -- one used by Viper, and another run by Calamp.

Using the same credentials as the app, the researchers were also able to log in and gain complete access to the Calamp server, the researchers said in their write-up.

"You could easily exploit it and as we had full access to the database," said Stykas in an email. "We could do a lot of stuff -- pretty much any scenario that we could think of was disastrous, like mass stealing cars or turning off vehicle via panic button when going with a high speed," he said.

By querying the database, Stykas said it was possible to find a car by looking up nearby latitude and longitude coordinates, reset the password, unlock the driver's side door, start the engine, and drive away.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Cars

Vulnerable in-vehicle infotainment systems have left some Volkswagen cars open to remote hacking, researchers warn.

Over the last few years, automakers like Ford, Jeep, Nissan and Toyota have all suffered car-hacking vulnerabilities in their vehicles. Now,  it looks like Volkswagen has been pulled into the mix after researchers discovered that in-vehicle infotainment (IVI) systems in certain Volkswagen-manufactured cars could be remotely hacked.

Not only that, but it’s possible to pivot to more critical systems.

The vulnerability was discovered in the Volkswagen Golf GTE and an Audi3 Sportback e-tron, which were both manufactured in 2015. Computest researchers Daan Keuper and Thijs Alkemade, who discovered the flaw, said that under certain conditions the IVI vulnerability could enable attackers to commandeer the on-board microphone to listen in on the conversations of the driver, turn the microphone on and off, and access the system’s complete address book and the conversation history. There is also a possibility of hackers tracking the car through the navigation system at any given time, they said.

A Volkswagen spokesperson told Threatpost that the vehicles impacted are those produced with Discover Pro infotainment systems – Golf GTE and Audi A3 e-tron.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Cars

https://www.scoop.it/t/securite-pc-et-internet/?&tag=iot

Zum Glück verstehen die Automobilhersteller und die Hersteller von Bordsystemen die Wichtigkeit der IT-Sicherheit und denken bereits darüber nach, wie man die Computersysteme vernetzter Autos, die noch nicht sehr verbreitet sind, schützen kann. Bei Kaspersky Lab sind wir bereit, um den Herstellern auf jegliche Art und Weise zur Seite zu stehen. Wir haben eine langjährige Erfahrung und das Experten-Knowhow, das man braucht, um Informationssysteme zu entwerfen, die schon ab ihrer Planung Schutz bieten.

Wir haben aktiv zusammen mit Herstellern von Automobilen und Herstellern von den dazugehörigen Cybersystem-Komponenten daran gearbeitet, Verteidigungsmechanismen zu entwerfen, die Bordcomputer gegen existierende und vorhersehbare Cyber-Bedrohungen schützen können. Genauer gesagt haben wir vor Kurzem ein strategisches Partnerschaftsabkommen mit dem Unternehmen AVL Software and Functions abgeschlossen. Innerhalb dieses Abkommens möchten wir ein sicheres Gateway, das anhand unseres eigenen Betriebssystems, KasperskyOS, funktioniert, entwickeln, welches einen sicheren Datenaustausch zwischen den Komponenten des vernetzten Autos und dem Bord-IT-System und den externen IT-Infrastrukturen ermöglicht.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Cars

Mit einem Arduino und Hardware im Wert von 40 US-Dollar lassen sich fast alle Modelle der VW-Gruppe aus den vergangenen 15 Jahren öffnen - sagen Sicherheitsforscher. Das Unternehmen hat die Lücke eingeräumt. 14 weitere Autohersteller sind betroffen.

Eine Gruppe von Sicherheitsforschern will im Laufe der Woche einen Hack vorstellen, mit dem sich die Türen von mehr als 100 Millionen Volkswagen öffnen lassen sollen, wie Wired berichtet. Der Hack basiert auf einer Arduino-Plattform, die benötigte Hardware soll sich für rund 40 US-Dollar einkaufen lassen.

Nach Angaben der Forscher sind folgende Modelle betroffen: Audi: A1, Q3, R8, S3, TT, VW: Amarok, New Beetle, Bora, Caddy, Crafter, e-Up, Eos, Fox, Golf 4, Golf 5, Golf 6, Golf Plus, Jetta, Lupo, Passat, Polo, T4, T5, Scirocco, Sharan, Tiguan, Touran, Up, Seat: Alhambra, Altea, Arosa, Cordoba, Ibiza, Leon, MII, Toledo und von Skoda: City Go, Roomster, Fabia 1, Fabia 2, Octavia, SuperB, Yeti.

Neben der Schwäche bei Autos der Volkswagen-Gruppe fanden die Forscher auch Probleme mit der Hitag-2-Technologie. Dieser wird von zahlreichen Herstellern eingesetzt. Der Zulieferer NXP sagte Wired, dass das verwendete Hitag-2-Kryptosystem einen alten Algorithmus verwende und das Unternehmen Kunden empfohlen habe, ein Upgrade durchzuführen.

Betroffen sind unter anderem die Autobauer Alfa Romeo, Citroën, Dacia, Fiat, Ford, Lancia, Mitsubishi, Nissan, Opel, Peugeot und Renault.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars

And it wants to hear if you think you've been a victim.

Learn more / En savoir plus / Mehr erfahren: 

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

http://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars

Durch "Keyless Entry" kann man ins Auto steigen und den Motor starten, ohne den Schlüssel zu benutzen. Mit der passenden Hardware können das allerdings auch Autodiebe. Alle 24 vom ADAC untersuchten Pkw-Modelle waren dafür anfällig.

Learn more / En savoir plus / Mehr erfahren: 

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

http://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars

How much do you know about the electric charging station where you plug in your electric vehicle?

New research at the University of Windsor is looking at security vulnerabilities of charging stations — not only could your payment information be stolen, but the electricity grid could be compromised too. 

Mitra Mirhassani, an engineering professor, said not enough is being done when it comes to security of these stations. 

"Most of the charging stations are placed wherever a company sees convenient," said Mirhassani. "These can be insecure roads and parking lots. Everyone seems to forget they are connected to infrastructure — to the energy grid."

Electric vehicle society 'encouraged' by approval of new charging locations
City of Windsor wants to add 11 dual-port electric vehicle charging stations
Mirhassani said if there was to be an attack on that energy infrastructure, there would be a lot of issues that couldn't be fixed quickly. 

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Cars

https://www.scoop.it/t/securite-pc-et-internet/?&tag=GRID

VW bugs: "Unpatchable" remote code pwnage

Two security researchers have excoriated Volkswagen Group for selling insecure cars. As in: hackable-over-the-internet insecure.

They broke into a recent-model VW and an Audi, via the cars’ internet connections, and were able to jump from system to system, running arbitrary code. Worryingly, they fully pwned the unauthenticated control bus connected to some safety-critical systems—such as the cruise control.

But VW has no way to push updates to its cars, and won’t alert owners to visit a dealer for an update.

Yes, it’s the internet of **** again: Potentially safety-critical bugs caused by the conflict between convenience and security. In this week’s Security Blogwatch, we prefer classic, analog vehicles.

Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: Globfinity War…

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Cars

https://www.scoop.it/t/securite-pc-et-internet/?&tag=iot

Selon Threat Post, deux chercheurs en sécurité de l'entreprise hollandaise Computest,  Daan Keuper et Thijs Alkemade, ont découvert des vulnérabilités dans le logiciel embarqué de la Volkswagen Golf GTE et de l'Audi3 Sportback e-tron

Ces vulnérabilités offrent pas mal d'amusements aux pirates : ouvrir le microphone pour écouter les conversation à l'intérieur du véhicule, accéder au carnet d'adresses complet, à l'historique des conversations, tracer le véhicule à travers son système de navigation, modifier l'affichage de l'écran du système..

Ce n'est pas tout... Poussant leurs investigations, les chercheurs ont constaté qu'il est possible de lire n'importe quel fichier sur le disque du système et même d'exécuter du code arbitraire à distance.

Volswagen commente l'affaire ainsi auprès de Threatpost : "Nous sommes en contact avec Computest depuis la mi-2017", la correction de bugs - en d'autres termes, l'élimination de la vulnérabilité - avait déjà eu lieu début mai 2016."

Fort bien... Toutefois en ce qui concerne les corrections des bugs, les chercheurs sont beaucoup plus nuancés : "Le système que nous avons étudié ne peut pas être mis à jour par l'utilisateur final, un utilisateur doit se rendre chez un revendeur officiel pour recevoir une mise à jour. Cependant, d'après notre expérience, il semble que les voitures qui ont été produites auparavant ne sont pas automatiquement mises à jour lorsqu'elles sont réparées chez un concessionnaire, elles sont donc toujours vulnérables à l'attaque décrite.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Cars

https://www.scoop.it/t/securite-pc-et-internet/?&tag=iot

Forscher des chinesischen Internetunternehmens Tencent demonstrieren, wie sie manche Funktionen eines Tesla Model S unautorisiert von fern steuern. Dabei gelang es ihnen auch, ein fahrendes Auto anzuhalten.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars

Modern cars contain tens of specialized computers that control everything from infotainment functions to steering and brakes. The pressing need to protect these computers from hackers will likely open up a new market for car-related software security products.

Karamba Security, a start-up based in Ann Arbor, Michigan, is one of the companies that has stepped up to answer this demand. The company's anti-malware technology, unveiled Thursday, is designed to protect externally accessible electronic control units (ECUs) found in connected cars.

These controllers, like those that handle handle telematics, infotainment and on-board diagnostics, can be accessed via Wi-Fi, Bluetooth or even the Internet, so they can serve as entry points for hackers into a car's network.

Learn more / En savoir plus / Mehr erfahren: 

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars

Fahrzeuge mit dem Komfort-Schließsystem "Keyless" sind deutlich leichter zu stehlen als solche mit normalem Funkschlüssel. Das zeigt eine ADAC-Untersuchung an über 20 Modellen.

Learn more / En savoir plus / Mehr erfahren: 

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

http://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

Self-driving cars could cut road deaths by 80%, but without better security they put us at risk of car hacking and even ransoms, experts at SXSW say...

Learn more / En savoir plus / Mehr erfahren: 

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

http://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars